{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:119392ce-989d-59f5-a811-70a6a4561694", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "jetty-all", "purl": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5", "type": "library", "group": "org.eclipse.jetty.aggregate", "bom-ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5", "version": "9.4.48.v20220622-tuxcare.5", "pedigree": { "ancestors": [ { "name": "jetty-all", "purl": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622", "type": "library", "group": "org.eclipse.jetty.aggregate", "version": "9.4.48.v20220622" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2006-6969", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:0a62d0d8-63c7-569c-8a0a-a6fa7089d630", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2006-6969 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2011-4461", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:dd2daaa7-ed46-5183-8430-8ea16344d560", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-4461 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2015-2080", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:0294e60e-c780-55c7-9db5-ef8f9d8fd982", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-2080 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2016-4800", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:03df8252-67b0-59a5-97e1-f9bfdb6e86b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-4800 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2017-7656", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:2005ae78-1acf-5031-9a5b-28295bc42401", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7656 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2017-7657", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:cb5e99c5-6753-5cde-b436-f8ed25a626e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7657 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2017-7658", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:54fff124-5c3e-5e98-bb6f-58d5b03145fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-7658 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2017-9735", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:c697f32e-50c0-53f8-a3ed-03c63ab91cb6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-9735 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2018-12536", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:4655845c-1554-5425-a421-9cdd6e846aad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12536 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2018-12538", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:3d940dee-1695-5d82-9a3a-8e3de25d2187", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12538 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2018-12545", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:9ea97bcb-03e8-511e-bb7d-5e377dc9c052", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-12545 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2019-10241", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:3b2d4967-f95c-562d-b0d2-dec00bfef944", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10241 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2019-10246", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:2ce732e9-c100-5f10-a21b-080c2e47249e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10246 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2019-10247", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:2e2fbe2e-9ef4-5959-86b8-63c617bf03a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10247 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2019-17632", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:f73b96ce-720c-5499-a3b4-cc97882ea019", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17632 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2019-17638", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:84feabae-9468-59a7-bb1e-5f8ec5573be7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-17638 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2020-27216", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:94d1f625-ddc6-57eb-813d-7d09c71ecece", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2020-27218", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:b715218d-55ac-55cd-bf5c-6d93031645a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27218 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2020-27223", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:872dba9a-5fb2-5c68-97e3-38ba671ea779", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27223 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2021-28163", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:b5aa969c-0469-5189-a052-54f95d94ddf4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28163 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2021-28165", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:6e342bee-7b35-53d7-9809-6c94f9fc9e0b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-28165 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2021-28169", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:00dee91b-6cb0-582d-a04d-6ff573428696", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-28169 is fixed in version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2021-34428", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:6cdaa6e1-51ee-5162-9afb-828cf9d702b9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-34428 does not affect version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all. Version 9.4.48.v20220622 is not affected by CVE-2021-34428: the security fix is already present in the target branch. Momus prerequisite check: \"All 1 patch commits already exist in target branch\". No backport needed." } }, { "id": "CVE-2022-2047", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:f9370688-5104-595d-90fa-376bdf01c027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2022-2048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:c2810a7b-952e-52a7-8d31-9f7fb56b5959", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2048 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2022-2191", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:19116677-4661-5f5b-8a6d-33b9da528684", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2191 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2023-26048", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:7f7af191-81b9-5cd3-bdca-7f2f15fb34d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26048 is fixed in version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2023-26049", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:930401c7-b308-5f84-a4e4-0645eaf5a8d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26049 is fixed in version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2023-36478", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:f9130417-2797-57ef-bbeb-51c76367982d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2023-36479", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:06d3e3dd-447e-5a2f-9bb2-1a4780b9b03d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-36479 is fixed in version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2023-40167", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:fd645332-da55-5f14-9c5b-b3d674809f73", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-40167 is fixed in version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2023-44487", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:9e2e1f28-b03f-57de-9cf0-a5d09c825d00", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-44487 is fixed in version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2024-13009", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:8b20e0b3-9a22-56e6-a28c-c3d40fc376ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-13009 is fixed in version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2024-22201", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:ff5d379a-1172-55b5-895d-59d70ec34d9a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2024-6763", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:67477374-e338-5771-b83b-264129bd6bf4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6763 is fixed in version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2024-7708", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:badc22bf-82ae-53a8-98d2-0569c8c5d4ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-7708 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2024-8184", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:3ed829e4-5b66-5765-ad71-2e3ca9db8e68", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-8184 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2024-9823", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:ddb434ec-25fa-5bba-899b-33ef0be85381", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-9823 is fixed in version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2025-11143", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:53f5ffb2-7e13-5dc1-a59d-10b70e0f9e51", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-11143 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2025-5115", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:f8b57372-6624-5ebe-8661-1af7cacf1d5b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-5115 is fixed in version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2026-10050", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:3f297e87-65e5-5d18-85c3-d080ba89d097", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2026-10051", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:29854fd1-b1d5-5676-a1d4-bfef3ae9579f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all. not_affected \u2014 CVE-2026-10051 describes an HTTP/1.1 keep-alive connection trailer cross-request leakage vulnerability in Jetty 12.x where the connection-scoped `_trailers` field is never reset between requests. The target Jetty 9.4.48.v20220622 has a different architecture (HttpChannelOverHttp + HttpChannel vs Jetty 12's HttpConnection internal structure) and already contains an upstream vendor fix from July ..." } }, { "id": "CVE-2026-1605", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:fea64dc3-ca2f-5bee-a982-192b24175ba4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all. Version 9.4.48.v20220622 is not vulnerable. Summary: Target repository is Jetty 9.4.48.v20220622-tuxcare.1, which is not in the affected version range. CVE-2026-1605 specifically affects Jetty 12.0.0-12.0.31 and 12.1.0-12.0.5. The architectures are fundamentally different between these major versions. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2026-18659", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:418012fc-311e-5689-8f03-0c7640b9f94e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18659 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2026-18661", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:a97bf567-4bee-5582-8d20-e2371fc5e6da", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18661 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2026-18662", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:627889ae-6d09-567c-93d4-34f7012a8eb6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-18662 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2026-19864", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:8f81fd20-27f2-5ec0-b707-efc02616c2d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-19864 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2026-2332", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:da177704-8e6e-5ee9-acba-83c653358bea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2026-5795", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:8dd4a700-5768-5ed9-9b1c-7374b594427e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-5795 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2026-6790", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:c1d3d9f8-52de-5e88-982f-d4f1f5bb8640", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } }, { "id": "CVE-2026-8384", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:5b345b94-9ae0-50c9-813f-61a164932d6a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all. not_affected \u2014 Jetty 9.4.48.v20220622 is not affected by CVE-2026-8384. The vulnerability exists in Jetty 12.1.8 where canonicalPath() has a semicolon-handling case that fails to update character-tracking state, breaking dot-segment detection. Version 9.4.48 uses a different architecture where canonicalPath() does not have explicit semicolon handling - semicolons are treated as regular characters in the defau...", "justification": "code_not_reachable" } }, { "id": "GHSA-58qw-p7qm-5rvh", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ], "bom-ref": "urn:uuid:72d2ed5e-a805-5f51-a22c-d2e48c900c15", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.4.48.v20220622-tuxcare.5 of org.eclipse.jetty.aggregate:jetty-all." } } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.aggregate/jetty-all@9.4.48.v20220622-tuxcare.5" } ] }